CVE-2019-13656

CVSS 9.8 CRITICALEPSS 5.8%CWE-284

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 5.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

06 Sep 2019Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

CA Technologies · Client Automation CA Technologies · Workload Automation AE

public PoCs found — 1

cve_referencepacketstormsecurity.com/files/154418/CA-Common-Services-Distributed-Intelligence-Architecture-DIA-Code-Execution.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/154418/CA-Common-Services-Distributed-Intelligence-Architecture-DIA-Code-Execution.html https://casupport.broadcom.com/us/product-content/recommended-reading/security-notices/CA20190904-01--security-notice-for-ca-common-services-distributed-intelligence-architecture-dia.html http://seclists.org/fulldisclosure/2019/Sep/15 https://seclists.org/bugtraq/2019/Sep/14